freebsd-nq/sys/security
Florian Walpen e28767f0e1 Thread creation privilege for realtime group
With the mac_priority(4) realtime policy active, users and processes in
the realtime group may promote existing threads and processes to
realtime scheduling priority. Extend the privileges granted to
PRIV_SCHED_SETPOLICY which allows explicit creation of new realtime
threads.

One use case of this is when the pthread scheduling policy is set to
SCHED_RR or SCHED_FIFO via pthread_attr_setschedpolicy(...) before
calling pthread_create(...). I ran into this when testing audio software
with realtime threads, particularly audio/ardour6.

MFC after:	1 week
Differential revision:	https://reviews.freebsd.org/D33393
2021-12-15 00:01:58 +02:00
..
audit vfs: remove the unused thread argument from NDINIT* 2021-11-25 22:50:42 +00:00
mac vfs: remove the unused thread argument from NDINIT* 2021-11-25 22:50:42 +00:00
mac_biba Add PRIV_SCHED_IDPRIO 2021-12-10 04:54:48 +02:00
mac_bsdextended Deduplicate fsid comparisons 2020-05-21 01:55:35 +00:00
mac_ifoff Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many) 2020-02-26 14:26:36 +00:00
mac_lomac Add PRIV_SCHED_IDPRIO 2021-12-10 04:54:48 +02:00
mac_mls security: clean up empty lines in .c and .h files 2020-09-01 21:26:00 +00:00
mac_none
mac_ntpd Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many) 2020-02-26 14:26:36 +00:00
mac_partition Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many) 2020-02-26 14:26:36 +00:00
mac_portacl Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many) 2020-02-26 14:26:36 +00:00
mac_priority Thread creation privilege for realtime group 2021-12-15 00:01:58 +02:00
mac_seeotheruids Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many) 2020-02-26 14:26:36 +00:00
mac_stub security: clean up empty lines in .c and .h files 2020-09-01 21:26:00 +00:00
mac_test Mark more nodes as CTLFLAG_MPSAFE or CTLFLAG_NEEDGIANT (17 of many) 2020-02-26 14:26:36 +00:00
mac_veriexec vfs: remove the unused thread argument from NDINIT* 2021-11-25 22:50:42 +00:00
mac_veriexec_parser security: clean up empty lines in .c and .h files 2020-09-01 21:26:00 +00:00